Commit Graph
4 Commits
Author SHA1 Message Date
Sunil 768937629a test: cover TomTom gate in dev and preview 2026-10-09 15:22:32 +05:30
Sunil ce5df4b8ab docs(security): include TomTom in same-site gate inventory 2026-10-09 15:22:26 +05:30
Sunil e32d2eb9ed Merge remote-tracking branch 'upstream/main' into fix/tomtom-cross-site-gate 2026-10-09 15:22:18 +05:30
Sunil 1f1dc2dca8 fix(traffic): refuse cross-site requests before they spend the TomTom budget
/api/tomtom/flow was the only keyed, billed proxy left outside the cross-site gate added in #900. Every uncached tile is an upstream attempt counted against the persistent daily budget, so any web page the user visits could fire <img> requests at distinct z8-z16 tiles, spend the TomTom quota and leave the traffic layer on 429 budget for the rest of the UTC day. Gate both routes with admitSameSite, like the Places routes.
2026-10-08 20:59:38 +05:30